Cuckoo Sandbox

Category	Started On	Completed On	Duration	Cuckoo Version
FILE	2018-03-14 21:52:20	2018-03-14 21:54:28	128 seconds	1.2

File Details

File name

e4e97090e9fd6cc3d321cee5799efd1806b5d8a9dea7c4872044057eb1c486ff

File size

348891 bytes

File type

Java archive data (JAR)

CRC32

D9C819BA

MD5

f48122e9f4333ba3bb77fac869043420

SHA1

02cc4cd5fbe40983ce084b9fa92d75c1d3da4954

SHA256

e4e97090e9fd6cc3d321cee5799efd1806b5d8a9dea7c4872044057eb1c486ff

SHA512

fe6b244a9b84ec76ec8c0c28ae0b30ebd8de4c5aa43a9b6269b1d7358d8ec5c0a8fc8bd99bdbf0f71d2e68fc08e71882731b15eb4141109b3de5fd4b7d90e791

Ssdeep

6144:AVknR9v8MnFle/shzyqEZd5KDixU5YBqukraN5jGh2fQzwETloY:AoUMFlzhzw50iEKKaNWFvTSY

PEiD

None matched

Yara

None matched

VirusTotal

Permalink
VirusTotal Scan Date: 2017-12-21 04:29:44
Detection Rate: 37/61 (Expand)

Antivirus	Version	Result
Ad-Aware	3.0.3.1010	Clean
AegisLab	4.2	Troj.AndroidOS.Agent.dd!c
AhnLab-V3	3.11.3.19504	Android-Trojan/Agent.ff78
Alibaba	1.0	A.L.Rog.KBLoder
ALYac	1.1.1.2	Clean
Antiy-AVL	3.0.0.1	Trojan/Android.TSGeneric
Arcabit	1.0.0.827	Android.Trojan.HiddenApp.AZ
Avast	17.8.3705.0	Android:Agent-JCB [Trj]
Avast-Mobile	171220-02	APK:RepMalware [Trj]
AVG	17.8.3705.0	Android:Agent-JCB [Trj]
Avira	8.3.3.6	ANDROID/Agent.LOE.Gen
AVware	1.5.0.42	Clean
Baidu	1.0.0.2	Android.Trojan.Agent.arr
BitDefender	7.2	Android.Trojan.HiddenApp.AZ
Bkav	1.3.0.9410	Clean
CAT-QuickHeal	14.00	Android.Agent.GEN824
ClamAV	0.99.2.0	Clean
CMC	1.1.0.977	Clean
Comodo	28206	Clean
Cyren	5.4.30.7	AndroidOS/GenBl.F48122E9!Olympus
DrWeb	7.0.28.2020	Android.DownLoader.229.origin
Emsisoft	4.0.2.899	Android.Trojan.HiddenApp.AZ (B)
ESET-NOD32	16607	a variant of Android/Agent.LE
F-Prot	4.7.1.166	Clean
F-Secure	11.0.19100.45	Clean
Fortinet	5.4.247.0	Android/Agent.LE!tr
GData	A:25.15273B:25.11162	Android.Trojan.HiddenApp.AZ
Ikarus	0.1.5.2	Trojan.AndroidOS.Agent
Jiangmin	16.0.100	Trojan/AndroidOS.vno
K7AntiVirus	10.35.25627	Clean
K7GW	10.35.25627	Trojan ( 004d01b51 )
Kaspersky	15.0.1.13	HEUR:Trojan.AndroidOS.Agent.dd
Kingsoft	2013.8.14.323	Clean
Malwarebytes	2.1.1.1115	Clean
MAX	2017.11.15.1	malware (ai score=88)
McAfee	6.0.6.653	Artemis!F48122E9F433
McAfee-GW-Edition	v2015	Clean
Microsoft	1.1.14405.2	Clean
MicroWorld-eScan	14.0.297.0	Android.Trojan.HiddenApp.AZ
NANO-Antivirus	1.0.100.20834	Trojan.Android.Agent.dxsonm
nProtect	2017-12-21.01	Clean
Panda	4.6.4.2	Clean
Qihoo-360	1.0.0.1120	Trojan.Android.Gen
Rising	25.0.0.1	Clean
Sophos	4.98.0	Andr/Dloadr-DZP
SUPERAntiSpyware	5.6.0.1032	Clean
Symantec	1.5.0.0	Trojan.Gen.2
SymantecMobileInsight	1.0.0.35_220	Trojan:Malapp
Tencent	1.0.0.1	Trojan.Android.Agent.aap
TheHacker	6.8.0.5.2221	Clean
TrendMicro-HouseCall	9.950.0.1006	Suspicious_GEN.F47V0918
Trustlook	2	Android.PUA.General
VBA32	3.12.26.6 usb	Clean
VIPRE	63294	Clean
ViRobot	2014.3.20.0	Clean
Webroot	1.0.0.207	Clean
WhiteArmor	None	Malware.HighConfidence
Yandex	5.5.1.3	Clean
Zillya	2.0.0.3451	Trojan.Agent..18958
ZoneAlarm	1.0	HEUR:Trojan.AndroidOS.Agent.dd
Zoner	1.0	Trojan.AndroidOS.Agent.A

Android Application Info

Package	com.example.loader
Main Activity	com.example.loader.MainActivity

Activities

Activity Name
com.example.loader.MainActivity
com.example.loader.LoadingActivity

Services

Service Name
com.example.loader.service.SystemService
com.example.loader.service.DownloadService
com.example.loader.service.ADService
com.example.loader.httpserver.WebSuiteService
com.example.loader.service.TestService

Receivers

Receiver Action
android.intent.action.BOOT_COMPLETED
android.intent.extra.TEMPLATE
android.intent.action.DATE_CHANGED
android.intent.action.MEDIA_MOUNTED
android.intent.action.MEDIA_UNMOUNTED
android.intent.action.PACKAGE_ADDED
android.intent.action.PACKAGE_REPLACED
android.intent.action.PACKAGE_REMOVED
android.intent.action.BOOT_COMPLETED
android.net.conn.CONNECTIVITY_CHANGE
android.intent.action.ACTION_SHUTDOWN
android.intent.action.ACTION_POWER_CONNECTED
com.limitmobi.action.PRENOTIFY

Permissions

Signatures

Application Dropped Files (Dynamic)

Application Fingerprint (Dynamic)

File has been identified by at least one AntiVirus on VirusTotal as malicious (Osint)

Application Contains Shared Object Files (Static)

Application Registered Receiver In Runtime (Dynamic)

Performs some HTTP requests

Umeng Adware (Detection)

Application Asks For Dangerous Permissions (Static)

File has been identified by more the 10 AntiVirus on VirusTotal as malicious (Osint)

Hidden Payload Found (Static)

Application Contains APK (Static)

Application Uses Reflection (Dynamic)

Application Set Component Enabled Setting (Dynamic)

Android Dynamic Analysis

Shell Commands

Queried Accounts

Dynamically Loaded Files

SMS Messages

Registered Broadcast Receivers

Crypto Keys

Encryption Plaintext

Content Resolver Queries

Intents

Reflection Calls

Fingerprints

Content Observers

Shared Preferences

Key	Value
session_id	93C1CD19E36E1161A3EA8108B0F23CD3
session_start_time	1521078789607
session_end_time	0
a_start_time	1521078789673
a_end_time	0
umeng_last_config_time	Thu Apr 09 17:34:16 CST 2015
umeng_net_report_policy	1
umeng_net_report_interval	0
serial	2
signature	07d277814fe2be08f9baa6ee6a9b597ad8db261d714cf33035ac2c0d77cea95a
bughd	true
oc_ec	-1
first_activate_time	1521078794477
successful_request	1
failed_requests	0
last_request_spent_ms	1195
last_request_time	1521078792449
last_req	1521078792449

Content Values

Telephone State Listen

Files Accessed By Application

System Properties

Android Static Analysis

Screenshots

Network Analysis

Hosts Involved

IP Address
ff02::16
ff02::1:ff12:3456
ff02::2
ff02::1
106.11.250.74
121.201.63.211
140.205.159.56
182.254.219.27
39.107.107.156
39.107.97.158
66.102.255.60
69.164.198.192

DNS Requests

Domain	IP Address
2.android.pool.ntp.org	69.89.207.199
1111.ip138.com
alog.umeng.com	106.11.250.137
oc.umeng.com	140.205.159.56
u.zhangjoy.com	182.254.219.27
collector.bughd.com	121.201.63.211
open.liqucn.com	39.107.107.156
dl001.liqucn.com	66.102.255.15
count.liqucn.com	39.107.97.158

HTTP Requests

URL	Data
http://alog.umeng.com/app_logs	POST /app_logs HTTP/1.1 X-Umeng-UTC: 1521078792435 X-Umeng-Sdk: Android/5.4.1 %E5%BF%AB%E6%92%AD%E5%AE%89%E8%A3%85%E5%99%A8%2F1.0.5+Nexus+5%2F4.1.2+3575E7E0F03294D2B42401993BE8A150 Msg-Type: envelope Content-Length: 608 Host: alog.umeng.com Connection: Keep-Alive
http://count.liqucn.com/d.php?id=41468&urlos=android&market_place_id=31&from_type=liqumarket_android	GET /d.php?id=41468&urlos=android&market_place_id=31&from_type=liqumarket_android HTTP/1.1 User-Agent: Dalvik/1.6.0 (Linux; U; Android 4.1.2; sdk Build/MASTER) Host: count.liqucn.com Connection: Keep-Alive Accept-Encoding: gzip
http://oc.umeng.com/check_config_update	POST /check_config_update HTTP/1.1 Content-Length: 346 Content-Type: application/x-www-form-urlencoded Host: oc.umeng.com Connection: Keep-Alive User-Agent: Dalvik/1.6.0 (Linux; U; Android 4.1.2; sdk Build/MASTER)
http://dl001.liqucn.com/upload/2017/286/r/com.qvod.player_3.4.39_liqucn.com.apk	GET /upload/2017/286/r/com.qvod.player_3.4.39_liqucn.com.apk HTTP/1.1 User-Agent: Dalvik/1.6.0 (Linux; U; Android 4.1.2; sdk Build/MASTER) Host: dl001.liqucn.com Connection: Keep-Alive Accept-Encoding: gzip
http://collector.bughd.com/actived	POST /actived HTTP/1.1 Content-Length: 512 Content-Type: text/plain; charset=ISO-8859-1 Host: collector.bughd.com Connection: Keep-Alive Accept-Encoding: gzip
http://open.liqucn.com/android/highapi.php?op=getinfo&index_id=41468	GET /android/highapi.php?op=getinfo&index_id=41468 HTTP/1.1 Host: open.liqucn.com Connection: Keep-Alive User-Agent: Apache-HttpClient/UNAVAILABLE (java 1.4)

Dynamic HTTP/HTTPS Requests

Request	Response
GET http://1111.ip138.com/ic.asp HTTP/1.1
POST http://oc.umeng.com/check_config_update HTTP/1.1 content=%7B%22report_policy%22%3A1%2C%22package%22%3A%22com.example.loader%22%2C%22appkey%22%3A%2255263da3fd98c5cbed0018a6%22%2C%22last_config_time%22%3A%22%22%2C%22sdk_version%22%3A%225.4.1%22%2C%22type%22%3A%22online_config%22%2C%22channel%22%3A%22liqu%22%2C%22idmd5%22%3A%224b4fbfb02e1bfb6c24ca3ee0f63ada54%22%2C%22version_code%22%3A%221%22%7D	HTTP/1.1 200 OK
POST http://oc.umeng.com/check_config_update HTTP/1.1 content=%7B%22report_policy%22%3A1%2C%22package%22%3A%22com.example.loader%22%2C%22appkey%22%3A%2255263da3fd98c5cbed0018a6%22%2C%22last_config_time%22%3A%22%22%2C%22sdk_version%22%3A%225.4.1%22%2C%22type%22%3A%22online_config%22%2C%22channel%22%3A%22liqu%22%2C%22idmd5%22%3A%224b4fbfb02e1bfb6c24ca3ee0f63ada54%22%2C%22version_code%22%3A%221%22%7D	HTTP/1.1 200 OK
POST http://oc.umeng.com/check_config_update HTTP/1.1 content=%7B%22report_policy%22%3A1%2C%22package%22%3A%22com.example.loader%22%2C%22appkey%22%3A%2255263da3fd98c5cbed0018a6%22%2C%22last_config_time%22%3A%22%22%2C%22sdk_version%22%3A%225.4.1%22%2C%22type%22%3A%22online_config%22%2C%22channel%22%3A%22liqu%22%2C%22idmd5%22%3A%224b4fbfb02e1bfb6c24ca3ee0f63ada54%22%2C%22version_code%22%3A%221%22%7D	HTTP/1.1 200 OK
GET http://open.liqucn.com/android/highapi.php?op=getinfo&index_id=41468 HTTP/1.1	HTTP/1.1 200 OK
GET http://open.liqucn.com/android/highapi.php?op=getinfo&index_id=41468 HTTP/1.1	HTTP/1.1 200 OK
GET http://open.liqucn.com/android/highapi.php?op=getinfo&index_id=41468 HTTP/1.1	HTTP/1.1 200 OK
POST http://collector.bughd.com/actived HTTP/1.1 {"sign":"1740","device":{"network_type":"LTE","is_rooted":true,"free_ram":"199080","device_id":"351451208401216","resolution":"320*480","class_name":"com.example.loader.MainActivity","sub_brand":"sdk","portrait":"landscape","os_version":"4.1.2","os_type":"android","total_space":"1019990","free_space":"1019688","total_ram":"341560","is_debuggable":false,"brand":"generic"},"app":{"build":"1","app_id":"com.example.loader","version":"1.0.5"},"ts":"1521078789","key":"0dcf8881fc705e61b80b10b3201cfc01","crash":{}}	HTTP/1.1 200 OK
POST http://alog.umeng.com/app_logs HTTP/1.1 X-Umeng-UTC: 1521078792435 X-Umeng-Sdk: Android/5.4.1 %E5%BF%AB%E6%92%AD%E5%AE%89%E8%A3%85%E5%99%A8%2F1.0.5+Nexus+5%2F4.1.2+3575E7E0F03294D2B42401993BE8A150 Msg-Type: envelope	HTTP/1.1 200 OK
POST http://alog.umeng.com/app_logs HTTP/1.1 X-Umeng-UTC: 1521078792435 X-Umeng-Sdk: Android/5.4.1 %E5%BF%AB%E6%92%AD%E5%AE%89%E8%A3%85%E5%99%A8%2F1.0.5+Nexus+5%2F4.1.2+3575E7E0F03294D2B42401993BE8A150 Msg-Type: envelope	HTTP/1.1 200 OK
POST http://alog.umeng.com/app_logs HTTP/1.1 X-Umeng-UTC: 1521078792435 X-Umeng-Sdk: Android/5.4.1 %E5%BF%AB%E6%92%AD%E5%AE%89%E8%A3%85%E5%99%A8%2F1.0.5+Nexus+5%2F4.1.2+3575E7E0F03294D2B42401993BE8A150 Msg-Type: envelope	HTTP/1.1 200 OK
POST http://collector.bughd.com/actived HTTP/1.1 {"sign":"1740","device":{"network_type":"LTE","is_rooted":true,"free_ram":"199080","device_id":"351451208401216","resolution":"320*480","class_name":"com.example.loader.MainActivity","sub_brand":"sdk","portrait":"landscape","os_version":"4.1.2","os_type":"android","total_space":"1019990","free_space":"1019688","total_ram":"341560","is_debuggable":false,"brand":"generic"},"app":{"build":"1","app_id":"com.example.loader","version":"1.0.5"},"ts":"1521078789","key":"0dcf8881fc705e61b80b10b3201cfc01","crash":{}}	HTTP/1.1 200 OK
GET http://count.liqucn.com/d.php?id=41468&urlos=android&market_place_id=31&from_type=liqumarket_android HTTP/1.1	HTTP/1.1 200 OK

Volatility

Nothing to display.

getprop ro.build.version.emui
getprop ro.miui.ui.version.name

android.intent.action.SCREEN_ON
android.intent.action.SCREEN_OFF

->values
android.os.PowerManager->isScreenOn

getDeviceId
getMacAddress
getNetworkOperatorName